0

A small number of my forwarded DNS queries cause BIND 9 to log messages such as:

184.in-addr.arpa SOA: got insecure response; parent indicates it should be secure
validating @0x7f93140c0870: 100.64-26.75.195.82.in-addr.arpa PTR: no valid signature found
validating @0x7f93100c8830: www.nbcnews.com A: no valid signature found
validating @0x7f93287f2a00: cabotelecom.com.br NSEC: verify failed due to bad signature (keyid=13661): RRSIG has expired

I am forwarding queries to a server supporting DNSSEC.

So: should I care about these, given that there is nothing I can do about them? If so, what can I really do about them?

1 Answer 1

2

The goal of DNSSEC is to add authenticity and integrity to query responses. DNSSEC can't tell you if your query responses are being intercepted, but it can tell you if the responses have been corrupted, tampered with, or are missing their signatures entirely. The messages you are seeing are notifying you of DNSSEC issues with the received responses (lack of signature, invalid signature, etc). If you are validating DNSSEC, these replies will be discarded.

The majority of DNSSEC validation issues are due to misconfiguration.

If they host in question is "important" and you suspect simple misconfiguration by the zone operator you can bypass validation specifically for those zones. That seems to be Google's official policy: https://developers.google.com/speed/public-dns/faq#gdns_validation_failure

Comcast takes the approach of notifying domain owners of DNSSEC issues: http://dns.comcast.net

2
  • Well...that's kind at the heart of my question. Given that configuration errors may occur even with the best sites, how much should I worry about occasional errors? It is unlikely someone intercepted one or two DNS queries. But if I set "dnssec-enable yes; dnssec-validation auto; dnssec-lookaside auto;" are these just informational messages and bind is safely discarding "insecure" responses? Or are these messages warnings that I'm using corrupt DNS data? Or intercepted data? Or ...?
    – simpleuser
    Feb 20, 2014 at 6:23
  • @user1663987 I updated the answer to provide some additional information. Feb 20, 2014 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .